EUVD-2026-108550

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can...

EUVD-2026-108549

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated...

EUVD-2026-108548

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

EUVD-2026-108551

The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the...

EUVD-2026-108543

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system...

CVE-2026-92450

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can...

CVE-2026-110825

The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the...

CVE-2026-110243

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated...

CVE-2026-107861

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

CVE-2026-109122

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system...

CVE-2026-110825

The Kiloview E3 NDI encoder is affected by a vulnerability where the ONVIF device service fails to require authentication for critical configuration write operations. An unauthenticated remote attacker can modify the hostname , DNS resolution , or NTP configuration . This allows for follow-on att...

CVE-2026-110825 Kiloview E3 NDI Encoder Missing Authentication for Critical Function

The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the...

CVE-2026-92450 Kiloview E3 NDI Encoder Use of Hard-coded Credentials

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can...

CVE-2026-92450

The Kiloview E3 NDI encoder firmware is vulnerable to a use of hard-coded credentials (CWE-798) within its authentication framework. The system signs session JSON Web Tokens using an HMAC-SHA256 secret that is hardcoded as a static string identical across all devices. An attacker who obtains the ...

CVE-2026-110491 Kiloview E3 NDI Encoder NULL Pointer Dereference

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be...

CVE-2026-110491

The Kiloview E3 NDI Encoder is vulnerable to a NULL Pointer Dereference (CWE-476) within its ONVIF service . An unauthenticated party with network access can trigger this by sending malformed or incomplete requests to specific operations, causing the service to stop accepting new connections. Whi...

CVE-2026-105265

The Kiloview E3 NDI Encoder is affected by a path traversal vulnerability (CWE-22) within its time zone parameter . Due to improper validation of user input, an authenticated user may cause the /etc/localtime file to point to a location outside the intended zoneinfo directory . The vulnerability ...

CVE-2026-105265 Kiloview E3 NDI Encoder Path Traversal

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory...

CVE-2026-96616

The Kiloview E3 NDI Encoder is vulnerable to Insufficient Session Expiration (CWE-613) within its web management interface. The root cause is that authentication tokens issued upon login are configured with an expiration time so extended that they effectively become non-expiring . If an attacker ...

CVE-2026-96616 Kiloview E3 NDI Encoder Insufficient Session Expiration

Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extend...